#934897 rdesktop: 1.8.6 crashes after login in Windows XP, rdp_recv(), unexpected stream overrun, 1.8.4 works

Package:
rdesktop
Source:
rdesktop
Description:
RDP client for Windows NT/2000 Terminal Server and Windows Servers
Submitter:
Ondrej Zary
Date:
2019-09-20 11:39:03 UTC
Severity:
important
#934897#5
Date:
2019-08-16 09:20:37 UTC
From:
To:
Dear Maintainer,
since upgrading rdesktop to 1.8.6, it does not work properly when connecting to a Windows XP system.
Windows login screen appears but rdesktop crashes immediately after entering correct username and password:
$ rdesktop 1.2.3.4
Autoselected keyboard map en-us
WARNING: Remote desktop does not support colour depth 24; falling back to 16
ERROR: rdp.c:140: rdp_recv(), unexpected stream overrun0000 03 00 00 1e 02 f0 80 68 00 01 03 eb 70 10 08 00 .......h....p...
0010 10 00 bc 7f e1 25 37 a6 63 72 04 00 16 00       .....%7.cr....


*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
   * What was the outcome of this action?
   * What outcome did you expect instead?

*** End of the template - remove these template lines ***

#934897#10
Date:
2019-08-16 19:36:17 UTC
From:
To:
Dear Maintainer,
I tried to get some information to this issue.

The error is given within this backtrace [1].

This is also present in the upstream git 1.8.x branch.

A git bisect points to upstream commit 82fce18.
However that commit seems to just add some checks to
not overrun some receive buffers. So it looks like
that overrun is since a longer time included but
got not detected.

Therefore might it be, that Windows XP just sends
packets with this byte less?
Attached patch checks if the end of the receive buffer
is already reached and just if not "extracts" the
"userid", which is not used at all later (as far as I see).
A package with this patch seemed to work like intended,
but maybe upstream can confirm this patch.

Upstream master seems to have moved some logic
in 1a82d41, so the line in question looks like
requesting now two bytes as "pduSource".

There is upstream issue [2] that seems about this issue.
It got closed because of unreproducibility, I am going to
comment there and point to this information.

Kind regards,
Bernhard


[1]
(gdb) bt
#0  _rdp_protocol_error (file=0x4517d8 "rdp.c", line=140, func=0x452068 <__func__.19872> "rdp_recv", message=0x450373 "unexpected stream overrun", s=0x474ba0 <g_in>) at rdp.c:1870
#1  0x004285f9 in rdp_recv (type=type@entry=0xbffff023 "") at rdp.c:140
#2  0x00428c72 in rdp_loop (deactivated=<optimized out>, ext_disc_reason=<optimized out>) at rdp.c:1777
#3  0x0042c157 in rdp_main_loop (deactivated=0xbffff128, ext_disc_reason=0xbffff12c) at rdp.c:1758
#4  0x004066a8 in main (argc=<optimized out>, argv=<optimized out>) at rdesktop.c:1191


[2] https://github.com/rdesktop/rdesktop/issues/342

#934897#17
Date:
2019-09-20 11:26:36 UTC
From:
To:
Dear Maintainer,
upstream issue [1] got closed with commit [2] in the master branch,
and should be contained in the upcoming release 1.9.0.

Unfortunately I guess the upstream 1.8.x branch will not
get an update for this, so either the patch in my previous
mail should work, or the change proposed in pull request [3].

Kind regards,
Bernhard

[1] https://github.com/rdesktop/rdesktop/issues/342
[2] https://github.com/rdesktop/rdesktop/commit/a646a5cce2ece3acc07ccead1e5f971cacc0db81
[3] https://github.com/rdesktop/rdesktop/pull/346/commits